Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: StrongDM Clear all filters
TI-2026-03815 CVE-2026-4387 · GHSA-qgjm-4mg2-6wm5

Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file

Priority LOW 10

StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file…

CVSS 4.0LOW 2.0 Local Low privileges No interaction EPSS 0.00132 Published 2026-05-29 Fixed in 23.74.0, 53.77.0 CWE-312
TI-2025-05592 CVE-2025-6183 · GHSA-w26h-fg7x-q5wc

Configd Injection

Priority LOW 30

The StrongDM macOS client incorrectly processed JSON-formatted messages.

CVSS 4.0HIGH 7.0 Local No auth No interaction EPSS 0.00162 Published 2025-08-20 No fix listed CWE-78
TI-2025-05591 CVE-2025-6182 · GHSA-725m-6gv3-xj6r

Root Certificate Injection

Priority LOW 37

The StrongDM Windows service incorrectly handled communication related to system certificate management.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00082 Published 2025-08-20 No fix listed CWE-269
TI-2025-05590 CVE-2025-6181 · GHSA-xvhc-jj62-7h84

OS command injection in StrongDM sdm-cli

Priority LOW 38

The StrongDM Windows service incorrectly handled input validation.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00154 Published 2025-08-20 No fix listed CWE-78
TI-2025-05589 CVE-2025-6180 · GHSA-54jv-mpgv-wvp2

Authentication Hijack

Priority LOW 36

The StrongDM Client insufficiently protected a pre-authentication token.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00111 Published 2025-08-20 No fix listed CWE-319